emotet | 3601bea7085bd103676b29f7eaa7becf1ea66ac5ec2e1a2c930a3e4ad69899d6

Analysis

Target
565.dll
Size 784KB
Sample220126-lr74esbgh3
SHA256 3601bea7085bd103676b29f7eaa7becf1ea66ac5ec2e1a2c930a3e4ad69899d6
MD5 65bd6c7c0ef569b15ddde21d7c3817d5
SHA1 c8f3ab859dd1a692ee19f24eba2c6f91914ab52e
SHA512 4fefd6a547377c55cc9343ef9a79c3bbb1463f1271cadee20421232eff8cdb296e9ee3dc6c9a18ac9b25e29927c466527069ba23691937d6e8666c0b9269d9b4
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1744 wrote to memory of 1480	1744	regsvr32.exe	27
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28
PID 1480 wrote to memory of 960	1480	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\565.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\565.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\565.dll",DllRegisterServer
    3⤵
    PID:960

memory/1480-55-0x0000000075761000-0x0000000075763000-memory.dmp

Download

memory/1480-56-0x00000000001F0000-0x0000000000217000-memory.dmp

Download

memory/1744-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Download